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WHAT IS CLAIMED IS: 

1. A method of determining a packet signature in a router, comprising: 
computing a signature of the router's network address; 
receiving a packet at the router; 

zeroing out selected fields in the received packet; and 

computing a signature of the received packet using the computed signature of the router's 
network address. 

2. The method of claim 1, wherein the selected fields comprise at least one of a time-to-live 
field, a type-of-service field, and a checksum field. 

3. The method of claim 1, wherein the signatures comprise cyclic redundancy checking 
(CRC) values. 

4. The method of claim 3, wherein the CRC values comprise CRC-32 values. 

5. The method of claim 1, wherein the signatures comprise hash values. 

6. A method of archiving signatures associated with packets received at nodes in a network, 
comprising: 
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receiving packets at a plurality of the nodes in the network; 

computing first signatures of the network addresses of each of the plurality of nodes; 
computing one or more second signatures for each of the received packets using the 
computed first signatures; and 

archiving the one or more computed second signatures in a memory device. 

7. The method of claim 6, wherein computing the one or more second signatures for each of 
the received packets further comprises: 

computing one or more cyclical redundancy checking values for each of the received 
packets. 

8. The method of claim 6, wherein computing the one or more second signatures of each of 
the received packets further comprises: 

computing one or more hash values for each of the received packets. 

9. The method of claim 6, wherein computing the one or more second signatures of each of 
the received packets further comprises: 

computing one or more CRC-32 values for each of the received packets. 
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10. A method of archiving signatures associated with packets received at a node in a network, 
comprising: 

receiving packets at the node; 

computing one or more signatures for each of the received packets; 
aggregating the computed one or more signatures in a first memory to produce one or 
more signature vectors; 

archiving the one or more signature vectors in a second memory. 

1 1 . The method of claim 10, wherein computing the one or more signatures for each of the 
received packets further comprises: 

computing one or more cyclical redundancy checking values for each of the received 
packets. 

12. The method of claim 10, wherein computing the one or more signatures for each of the 
received packets further comprises: 

computing one or more hash values for each of the received packets. 

13. The method of claim 10, wherein computing the one or more signatures for each of the 
received packets further comprises: 

computing one or more CRC-32 values for each of the received packets. 
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14. The method of claim 10, wherein the second memory comprises a ring buffer. 

15. The method of claim 10, wherein the computed one or more signatures are aggregated 
over a collection interval R. 

16. The method of claim 15, wherein archiving the one or more signature vectors comprises: 
storing the one or more signature vectors in the second memory indexed by the collection 

interval. 

17. The method of claim 10, wherein archiving the one or more signature vectors comprises: 
storing a fraction of the one or more signature vectors in the second memory. 

18. The method of claim 10, further comprising: 

discarding signature vectors of the archived one or more signature vectors that are older 
than P seconds. 

19. The method of claim 15, further comprising: 

randomly zeroing out a fraction of the one or more signature vectors that are older than P 
seconds. 
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20. The method of claim 19, further comprising: 

merging bits of the signature vectors that are older than P seconds. 

2 1 . The method of claim 20, further comprising: 

archiving the merged bits in the second memory for a period equaling a multiple of the 
collection interval R. 

22. The method of claim 21, wherein the multiple of the collection interval R comprises 
10*R. 

23. The method of claim 10, wherein the second memory comprises a DRAM. 

24. An apparatus for archiving signatures associated with packets received at a node in a 
network, comprising: 

a first memory; 

a second memory; 

a signature tap configured to: 

receive packets at the node; 

compute one or more signatures for each of the received packets; 
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a multiplexer configured to: 

aggregate the computed one or more signatures in the first memory to produce one 
or more signature vectors; and 
a controller configured to: 

archive the one or more signature vectors in the second memory. 

25. The apparatus of claim 24, the one or more signature vectors comprising one or more 
cyclical redundancy checking values. 

26. The apparatus of claim 24, the one or more signature vectors comprising one or more 
hash values. 

27. The apparatus of claim 24, the one or more signature vectors comprising one or more 
CRC-32 values. 

28. The apparatus of claim 24, wherein the second memory comprises a ring buffer. 

29. The apparatus of claim 24, the multiplexer further configured to: 
aggregate the one or more signatures over a collection interval R. 
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30. The apparatus of claim 29, the controller further configured to: 

store the one or more signature vectors in the second memory indexed by the collection 
interval. 

3 1 . The apparatus of claim 24, the controller further configured to: 

store a fraction of the one or more signature vectors in the second memory. 

32. The apparatus of claim 24, the controller further configured to: 

discard signature vectors of the archived one or more signature vectors that are older than 
P seconds. 

33. The apparatus of claim 29, the controller further configured to: 

randomly zero out a fraction of the one or more signature vectors that are older than P 
seconds. 

34. The apparatus of claim 33, the controller further configured to: 
merge bits of the signature vectors that are older than the P seconds. 
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35. The apparatus of claim 34, the controller further configured to: 

archive the merged bits in the second memory for a period equaling a multiple of the 
collection interval R. 

36. The apparatus of claim 35, wherein the multiple of the collection interval R comprises 
10*R. 

37. The apparatus of claim 24, wherein the second memory comprises a DRAM. 

38. A method of archiving signatures associated with packets received at a node in a network, 
comprising: 

receiving packets at the node; 

computing one or more signatures for each of the received packets; 
aggregating the computed one or more signatures in a first memory to produce one or 
more signature vectors; 

archiving the one or more signature vectors in a second memory. 
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